ci: Sign Windows heidisql.exe via SignPath - #2617

Summary

• Sign the Windows out/win64/heidisql.exe built by the lazarus.yaml workflow via SignPath (signpath/github-action-submit-signing-request@v2)
• The unsigned exe is uploaded as a workflow artifact first (SignPath trusted-build-system requirement), then submitted for signing using project HeidiSQL and signing policy test-signing; the signed result is uploaded as windows-latest-WIN64-signed
• Signing steps only run when the SIGNPATH_ORGANIZATION_ID repo variable is set; the existing unsigned artifact upload stays intact

Verification

• Full pipeline verified end-to-end in run 36470699724: build → PE-flag check → unsigned upload → SignPath signing request → signed artifact upload, all green
• Signature in the signed artifact was manually verified (Authenticode certificate present)

Notes / follow-ups

• The action is pinned to v2 (legacy connector) as a workaround: v3 (new pipeline connector) fails with "User has no access to the requested GitHub resource" — SignPath support has been contacted; switch back to v3 once resolved
• A dedicated release signing policy will be added later (current release-signing policy is invalid); until then test-signing is used
• Required repo config: secret SIGNPATH_API_TOKEN, variable SIGNPATH_ORGANIZATION_ID
• SignPath artifact configuration for project HeidiSQL: <zip-file><pe-file path="heidisql.exe"><authenticode-sign /></pe-file></zip-file>

Related issue: #2111 (note: auto-close does not apply since this PR targets the lazarus branch; close manually after switching Windows releases to the signed builds)